test[faustwp]: widen AuthCallbacks coverage and document home_url() filter caveat

Three small additions on top of the regression-test commits:

1. Assert that the redirect_uri query arg is preserved through to the
   wp-login redirect_to param, in both the standard and Bedrock cases.
   A future change that successfully matched the request but mangled or
   dropped redirect_uri would previously slip through.

2. Add test_wp_in_subdirectory_install_matches_with_home_url for the
   Codex-documented 'Giving WordPress its own directory' pattern -- WP
   core in /wordpress, public site at root. Different prefix from Bedrock,
   same shape of divergence. Proves the fix is not a /wp-special case.
   Renames set_bedrock_siteurl() to set_split_install_siteurl($suffix)
   so both tests share the helper.

3. Document the home_url() filter dependency in handle_generate_endpoint()'s
   docblock. Multilingual plugins (WPML, Polylang, TranslatePress) that
   filter home_url() to prepend locale paths can still cause this match to
   miss for non-locale-prefixed frontend callers. Notes the likely follow-up
   direction (REST route migration) so the next person to touch this knows
   what they're inheriting.

Suite is now 5 tests / 14 assertions. Verified red-on-revert: both the
Bedrock and WP-in-subdirectory tests fail cleanly when callbacks.php is
reverted to site_url(); restoring home_url() greens both single-site and
multisite suites.

Author: josephfusco

plugins/faustwp/includes/auth/callbacks.php

@@ -19,6 +19,13 @@
  *
  * Generate an authorization code and redirect to the requested url.
  *
+ * Note: matches REQUEST_URI against the filtered output of home_url(). Plugins
+ * that filter home_url() to prepend locale paths (WPML, Polylang, TranslatePress)
+ * may cause this match to fail when the frontend calls '/generate' directly
+ * without a locale prefix. If that combination surfaces in support, the
+ * follow-up will likely migrate '/generate' to a proper REST route so locale
+ * filters cannot affect the match.
+ *
  * @return void
  */
 function handle_generate_endpoint() {

plugins/faustwp/tests/integration/AuthCallbacksTests.php

@@ -71,14 +71,19 @@ public function tearDown(): void {
 	}
 
 	/**
-	 * Reconfigure the WordPress siteurl option to mirror a Bedrock-style install
-	 * (WP core under /wp/, public site at root). Matches what
-	 * `composer create-project roots/bedrock` configures via WP_SITEURL in
-	 * wp-config.php.
+	 * Reconfigure the WordPress siteurl option to a split-install layout where WP
+	 * core lives in a subdirectory of the public site.
+	 *
+	 * Default suffix '/wp' mirrors Bedrock (what `composer create-project roots/bedrock`
+	 * sets via WP_SITEURL in wp-config.php). Pass '/wordpress' for the Codex-documented
+	 * "Giving WordPress its own directory" pattern, or any other prefix to exercise
+	 * other split-install configurations.
+	 *
+	 * @param string $suffix Path appended to the home option to form siteurl. Defaults to '/wp'.
 	 */
-	private function set_bedrock_siteurl(): void {
+	private function set_split_install_siteurl( string $suffix = '/wp' ): void {
 		$home = (string) get_option( 'home' );
-		update_option( 'siteurl', rtrim( $home, '/' ) . '/wp' );
+		update_option( 'siteurl', rtrim( $home, '/' ) . $suffix );
 	}
 
 	/**
@@ -98,7 +103,10 @@ private function invoke_handler() {
 
 	/**
 	 * Standard install: REQUEST_URI matches the default search pattern; the
-	 * function proceeds to wp_safe_redirect (login-redirect branch).
+	 * function proceeds to wp_safe_redirect (login-redirect branch). The
+	 * redirect_uri query arg from the original request must be carried through
+	 * into the wp-login redirect_to param so the user lands back at the right
+	 * frontend after authenticating.
 	 */
 	public function test_standard_install_matches_and_redirects(): void {
 		$_SERVER['REQUEST_URI'] = '/generate?redirect_uri=https://frontend.example/';
@@ -108,6 +116,11 @@ public function test_standard_install_matches_and_redirects(): void {
 
 		$this->assertNotNull( $redirect, 'Standard install must reach wp_safe_redirect.' );
 		$this->assertStringContainsString( 'wp-login.php', $redirect );
+		$this->assertStringContainsString(
+			'frontend.example',
+			$redirect,
+			'redirect_uri value must be preserved in the wp-login redirect_to param.'
+		);
 	}
 
 	/**
@@ -119,7 +132,7 @@ public function test_standard_install_matches_and_redirects(): void {
 	 * the public REQUEST_URI.
 	 */
 	public function test_bedrock_divergence_matches_with_home_url(): void {
-		$this->set_bedrock_siteurl();
+		$this->set_split_install_siteurl( '/wp' );
 
 		// Sanity-check the divergence we just configured: site_url carries /wp,
 		// home_url does not. If these fail, the test environment itself is broken
@@ -137,6 +150,33 @@ public function test_bedrock_divergence_matches_with_home_url(): void {
 			'Bedrock layout (siteurl includes /wp, home does not) must still match REQUEST_URI=/generate when home_url() is used.'
 		);
 		$this->assertStringContainsString( 'wp-login.php', $redirect );
+		$this->assertStringContainsString( 'frontend.example', $redirect );
+	}
+
+	/**
+	 * "Giving WordPress its own directory" install: the Codex-documented pattern
+	 * where WP core is installed in a subdirectory (e.g. /wordpress) but the
+	 * site is served from the public root. Different prefix from Bedrock, same
+	 * shape of divergence -- proves the fix generalises beyond '/wp' specifically.
+	 *
+	 * Ref: https://wordpress.org/documentation/article/giving-wordpress-its-own-directory/
+	 */
+	public function test_wp_in_subdirectory_install_matches_with_home_url(): void {
+		$this->set_split_install_siteurl( '/wordpress' );
+
+		$this->assertStringEndsWith( '/wordpress/generate', site_url( '/generate', 'relative' ) );
+		$this->assertStringEndsWith( '/generate', home_url( '/generate', 'relative' ) );
+
+		$_SERVER['REQUEST_URI'] = '/generate?redirect_uri=https://frontend.example/';
+		$_GET['redirect_uri']   = 'https://frontend.example/';
+
+		$redirect = $this->invoke_handler();
+
+		$this->assertNotNull(
+			$redirect,
+			'WP-in-subdirectory layout (siteurl includes /wordpress, home does not) must still match REQUEST_URI=/generate.'
+		);
+		$this->assertStringContainsString( 'wp-login.php', $redirect );
 	}
 
 	/**